6.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2023-43636

CVE-2023-43636: EVE Doesn't Protect Rootfs

Impact

Measured boot validates BIOS, grub, kernel cmdline, and initrd but not the entire rootfs. Thus, an attacker can create an EVE-OS rootfs squashfs image with some files modified and take out the disk and replace the existing rootfs image without that being detected by measure boot and remote attestation.

Patches

Fixed in 8.6.0 and 8.12.1-lts

Workarounds

None

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2023-43636

CVE-2023-43636:

6.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/lf-edge/eve/pkg/grub	go	< 0.0.0-20220708121648-5fef4d92e758	0.0.0-20220708121648-5fef4d92e758

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, CVE-2023-43636, lies in the EVE-OS measured boot process, which failed to validate the integrity of the root filesystem (rootfs). This allowed an attacker with physical access to tamper with the rootfs without detection. The analysis of the provided patches reveals that the vulnerability was not in a specific Go function but rather in the GRUB bootloader's configuration and capabilities.

The core of the vulnerability is the absence of an integrity measurement step for the rootfs and configuration partitions during the boot sequence. The patches address this by introducing a new GRUB command called measurefs. This command is implemented in C and added to the GRUB build process. The measurefs command calculates a cryptographic hash of a given filesystem and extends a specific Platform Configuration Register (PCR) in the TPM, in this case, PCR 13.

The identified vulnerable functions, set_rootfs_root and set_config_overrides, are shell functions within the pkg/grub/rootfs.cfg GRUB configuration file. These functions are responsible for locating and setting up the root and configuration partitions during boot. Before the patch, these functions would prepare the system to boot from these partitions without verifying their contents. The patch modifies these functions to call the new measurefs command, ensuring that any modification to these partitions will result in a different PCR 13 value.

Furthermore, a second commit links this new measurement to the system's security by sealing the disk encryption key to PCR 13. The change in pkg/pillar/evetpem/tpm.go adds PCR 13 to the DiskKeySealingPCRs list. This ensures that the disk can only be decrypted if the rootfs and configuration partitions have not been tampered with, effectively mitigating the vulnerability.

Vulnerable functions

set_rootfs_root

pkg/grub/rootfs.cfg

This function, part of the GRUB boot configuration, is responsible for setting the root filesystem. Prior to the patch, it did not perform any integrity measurement of the rootfs. This allowed an attacker with physical access to replace the rootfs with a malicious version, which would not be detected by the measured boot process. The patch adds a call to `measurefs` to calculate a hash of the rootfs and extend PCR 13, thus ensuring the integrity of the rootfs is verified.

set_config_overrides

pkg/grub/rootfs.cfg

This function handles loading configuration overrides from the CONFIG partition. Similar to `set_rootfs_root`, this function did not measure the integrity of the configuration partition before the patch. This would allow an attacker to modify the configuration files to alter system behavior without being detected. The patch mitigates this by adding a call to `measurefs` to measure the CONFIG partition into PCR 13.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

6.7

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2023-43636: EVE Doesn't Protect Rootfs

Impact

Patches

Workarounds

CVE-2023-43636:

6.7

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

CVE-2023-43636: EVE Doesn't Protect Rootfs

Impact

Patches

Workarounds

6.7

6.7

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI